---
schema_version: "1"
id: 31f630e228df0183935e2a2cda2b541e6be215a1b28c8c034a567f7c28d73f94
title: Declarative Security via HTTP Headers in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_declarative_security_via_http_headers.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_declarative_security_via_http_headers.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 07e6237d2632c21542c76598ce010c5e19f34dc4f2c3ec8e3ed6ac31ba943515
description: You can use declarative security controls as a strong line of defense against client browser-based attacks such as clickjacking and offer built-in browser protection against cross-site scripting (XSS). The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Declarative Security via HTTP Headers in B2C Commerce

You can use declarative security controls as a strong line of defense against client browser-based attacks such as clickjacking and offer built-in browser protection against cross-site scripting (XSS). The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application.

The B2C Commerce APIs and the Storefront Reference Architecture (SFRA) provide this capability. Set HTTP headers on an HTTP response using the `addHttpHeader()` method on the Response object. If your storefront or cartridge is SFRA-based, you can use the `httpHeadersConf.json` file to automatically set HTTP response headers on _all_ responses.

Declarative security controls via HTTP headers and other client browser-based protections apply only if the client’s browser supports the feature. Check the B2C Commerce list of support browsers before relying on a header to cover all supported user environments.